SENATE BILL REPORT

ESB 6018

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Passed Senate, January 18, 2018

Title: An act relating to consumer reporting agency security freezes.

Brief Description: Concerning security freeze fees charged by consumer reporting agencies.

Sponsors: Senators Mullet, Carlyle, Palumbo, Frockt, Rolfes, Hunt, Fain, Keiser, Van De Wege, Hasegawa, Nelson, Pedersen and Kuderer.

Committee Activity: Financial Institutions & Insurance: 1/09/18, 1/11/18 [DP, DNP, w/oRec].

Floor Activity:

Passed Senate: 1/18/18, 46-2.

Brief Summary of Engrossed Bill

Removes the $10 fee a consumer reporting agency may charge a consumer for placing and removing a security freeze on the consumer's credit report.

SENATE COMMITTEE ON FINANCIAL INSTITUTIONS & INSURANCE

Majority Report: Do pass.

Signed by Senators Mullet, Chair; Hasegawa, Vice Chair; Angel, Ranking Member; Kuderer.

Minority Report: Do not pass.

Signed by Senator Fortunato.

Minority Report: That it be referred without recommendation.

Signed by Senator Baumgartner.

Staff: Jeff Olsen (786-7428)

Background: Consumer credit reports contain personal information, including: name, address, social security number, bill paying habits, credit history, and public record information on bankruptcies, liens, and court judgments. There are three primary consumer credit reporting agencies: Equifax, Experian, and Transunion. Consumer reporting agencies regularly obtain information from national credit card companies, automobile finance companies, student loan companies, and other sources. A person, business, or government agency may request a credit report from a consumer credit reporting agency for legitimate business needs involving a transaction with a consumer including an application for credit, opening an account, a security clearance, employment, or collection of an account.

Any consumer in Washington may request that a consumer reporting agency (agency) place a security freeze on the consumer's credit report. A security freeze is a prohibition on the agency's release of a consumer's credit report to a third party intending to use the credit report to determine the consumer's eligibility for credit. The request for a security freeze must be submitted in writing via certified mail to the agency. The agency is permitted to charge $10 for the placement of a security freeze.

Subject to certain exceptions, the agency is prohibited from releasing the report or information from the report without the consumer's express permission. The agency must give the consumer a personal identification number, which the consumer may use to make a request for a temporary lift of the freeze or for a release to a particular person or entity. Currently, the consumer reporting agency may charge $10 for the removal or temporary lift of a security freeze. Victims of identity theft and persons over 65 years old may place or lift a security freeze free of charge. A consumer's request for a security freeze does not prohibit the release of the consumer's credit report for purposes that are not credit-related.

Summary of Engrossed Bill: An agency may not charge a consumer for placing a security freeze on a credit report, assigning a unique PIN, temporarily lifting a security freeze, or removing a security freeze. The requirement that a consumer may request a security freeze in writing by certified mail is removed.

The Office of Cybersecurity, the Office of Privacy and Data Protection, and the Attorney's General Office must work with stakeholders to evaluate the impact to consumers and the consumer reporting agencies regarding removal of the security freeze fees. The report must include trends in data breaches, best practices for preventing cybersecurity attacks, identity theft mitigation services available to consumers, and identity theft mitigation protocols recommended by the Federal Trade Commission, the Consumer Financial Protection Bureau, and other relevant federal or state agencies. The report must be submitted to the Legislature by December 1, 2020.

Appropriation: None.

Fiscal Note: Not requested.

Creates Committee/Commission/Task Force that includes Legislative members: No.

Effective Date: Ninety days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony: PRO: Due to a data breach, consumers, through no fault of their own, are being charged up to $60 to freeze and unfreeze their credit to protect their financial information. Millions of people were impacted, and the resulting fees could generate millions of dollars for the industry. Consumers need to have control of their own information. Fraud alerts and credit monitoring are not effective tools.

CON: The consumer data industry is also a victim in the data breach that occurred. A credit freeze may not be the best tool for consumers. Consumers should consider using a fraud alert, rather than a credit freeze, which is provided free of charge.

Persons Testifying: PRO: Senator Mark Mullet, Prime Sponsor; Lee Cutbirth, citizen; Cathy Maccaul, AARP; Elise Orlick, WashPIRG Director; Catherine Fleming, Stritmatter Kessler Law Firm/Attorney. CON: Cliff Webster, Consumer Data Industry Association.

Persons Signed In To Testify But Not Testifying: No one.